CVE-2025-7493: Freeipa: idm: privilege escalation from host to domain admin in freeipa

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-30 · updated 2026-06-17
Weakness: CWE-1220

Description

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:4.12.2-15.el10_0.4
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:4.6.8-5.el7_9.23
Red Hat Enterprise Linux 8: all versions — fixed in 8100020250918211722.823393f5, 8100020250919180242.143e9e98
Red Hat Enterprise Linux 8.2 Advanced Update Support: all versions — fixed in 8020020250924104944.792f4060, 8020020250924110056.50ea30f9
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 8040020250923175408.5b01ab7e, 8040020250923180004.f153676a
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 8040020250923175408.5b01ab7e, 8040020250923180004.f153676a
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020250916172436.c1533a64, 8060020250916174421.ada582f1
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 8060020250916172436.c1533a64, 8060020250916174421.ada582f1
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 8060020250916172436.c1533a64, 8060020250916174421.ada582f1
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 8080020250918152850.b0a6ceea, 8080020250918184739.e581a9e4
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 8080020250918152850.b0a6ceea, 8080020250918184739.e581a9e4
Red Hat Enterprise Linux 9: all versions — fixed in 0:4.12.2-14.el9_6.5
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:4.9.8-11.el9_0.5
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:4.10.1-12.el9_2.6
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:4.11.0-15.el9_4.7

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:4.12.2-15.el10_0.4; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.23; Red Hat Enterprise Linux 8 8100020250918211722.823393f5, 8100020250919180242.143e9e98; Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020250924104944.792f4060, 8020020250924110056.50ea30f9; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020250923175408.5b01ab7e, 8040020250923180004.f153676a; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020250923175408.5b01ab7e, 8040020250923180004.f153676a; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250916172436.c1533a64, 8060020250916174421.ada582f1; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250916172436.c1533a64, 8060020250916174421.ada582f1; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250916172436.c1533a64, 8060020250916174421.ada582f1; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020250918152850.b0a6ceea, 8080020250918184739.e581a9e4; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020250918152850.b0a6ceea, 8080020250918184739.e581a9e4; Red Hat Enterprise Linux 9 0:4.12.2-14.el9_6.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-7493 or the next vulnerability affects your stack